17 June 2018

STANAG-4285 128 bit 1536F protocol (UK MoD?)

I followed these STANAG-4285 transmissions on 14548.2/usb throughout the morning and the first part of the afternoon. Unlike similar S-4285 broadcasts, there is not a continuous broadcast and the messages are transmitted to the need and always using the 1200bps Long interleaver sub-mode.
After convolutional decoding and de-interleaving, the data link protocol exhibits a 128-bit structure but actually it's the 1536-bit TDM protocol (thanks to KarapuZ). TDoA multilateration using 4 KiwiSDRs as sensors points to Cyprus Island as Tx site: maybe UK MoD from Akrotiri?

Fig. 1
Fig. 2

Fig. 3

15 June 2018

STANAG-4539: unexpected data rate of 12800 bps

Long transmission (hours) of STANAG-4539 8PSK 2400 Bd bursts spotted on 14 June morning on 7807.2/usb:  each burst lasting 1680 ms and composed of 13 x 287 tribit symbols frames. It's interesting to note the uncoded 12800 bps speed detected by the 5710-A modem: using 8PSK at a modulation rate of 2400Bd, the the maximum data rate obtainable is 4800 bps (7200 bps on-air) therefore there is something wrong somewhere (a data rate of 12800 bps is obtainable using QAM64 modulation at 2400 Bd). STANAG-4539 is an "auto-baud" waveform, so perhaps they use a modified preamble that misleads the modem.
A run of TDoA multilateration says Cornwall (UK) as Tx location, possibly UK MoD tests from St.Eval? 

Fig. 1
Fig. 2
Fig. 3
https://yadi.sk/d/bpzDxsBX3Xzkn3
 

12 June 2018

TDMA waveforms (STANAG-4539 Annex D,...) and NILE/Link-22

Recently, some friends and me happened to run into QPSK and 8PSK burst waveforms that are among those described by STANAG-4539 for TDMA operations (Time Division Multiple Access) and that are used by NILE/Link-22. Even if I do not have a direct confirmation, my prudent guess is that it is probably about Link-22 transmissions.

In TDMA mode each user is allowed to transmit only within specified time intervals (Time Slots) so that different users transmit in differents time slots. When users transmit, they occupy the whole frequency bandwidth (separation among users is performed in the time domain). 
According to S-4539 D, a TDMA slot is the high level structure in which information will be transmitted/received and it is composed of a Preamble, a certain number of Media Code Frames and a Guard Time (Fig. 1).

Fig. 1 - TDMA Slot Time
A Media Code Frame is composed of 270 symbols to be transmitted/ received at the modulation rate of 2400 baud and following a certain waveform structure (Traffic Waveform) with different waveforms and modulation. Each Traffic Waveform is composed of a sequence of different DATA blocks and Mini Probe (MP) blocks: the DATA block contains coded user information symbols and the MP block contains known training symbols to be used by the equaliser. There are two different types of PSK modulations: QPSK and 8PSK. The QPSK modulation is used for preamble transmission, QPSK or 8PSK are used for Media Code Frame transmission.
As far as I know, and from S-4539 D, the 270 symbols of a Media Code Frame are arranged according the used Traffic Waveforms (TWF):
TWF1: 4 packages with 48 data and 19/20 probes 
TWF2: 8 packages with 18 data and 15/16 probes
TWF3: 4 packages with 48 data and 19/20 probes
TWF4 to WF7: 1 package with 240 data and 30 probes 8PSK 
TWF?: 3 packages with 60 data and 30 probes 

That said, the  270 symbols (length of the Media Code Frame) sent at 2400 symbols/sec, regardless the used Traffic Waveform, should produce an ACF value of 112.5ms.
The analysis of the signals was therefore targeted at checking that ACF value, the structure of the Media Code Frames (Traffic Waveforms) and some other possible regularities among the signals. Unfortunately I have only the annex D of S-4539 which specifies only the first three Traffic Waveforms while from some advertising on the internet, Fig. 2, one can see that they can be up to 18 (Annex G).

Fig. 2 - STANAG-4539/Link-22 Traffic Waveforms
The lack of official documentation means that these signals can not be identified exactly as Link-22, but there is a good chance that they will be.

QPSK modulations
Below an interesting  4 Media Code Frame slots transmission (Fig. 4). Each Media Code Frame (270 symbols, 112.5ms) seems composed of 3 packages with 60 data and 30 probes (Fig. 5)

Fig. 4 - 4 Media Code Frame slots
 
Fig. 5 - Traffic Waveform composed of 3 packages
In Fig.6 is shown a Media Code Frame that uses a Traffic Waveform composed of only 1 package (TWF 1-7) followed by a 3 packages Traffic Waveform (37.5ms).

Fig. 6

8PSK modulations
In this sample the Media Code Frame uses a Traffic Waveform composed of two packages (Fig. 7)

Fig. 7 - 2 packages Traffic Waveform

Regularities
As verified by KarapuZ, all the analyzed signals have the same preamble: here below, Figs. 8 and 9, an example of two signals (8PSK and QPSK)

Fig. 8
Fig. 9
(to be continued)

10 June 2018

CIS-12 TDoA measurements using GPS time-stamped IQ samples from KiwiSDRs

TDOA (Time Difference Of Arrival), also known as multilateration, is a well-established technique for the geolocation of RF emitters. Using three or more receivers, TDOA algorithms locate a signal source from the different arrival times at the receivers.
In this case, TDoA measurements are related to a CIS-12 signal (modem AT-3004D) spotted this morning on 11414.0 KHz/usb and use GPS time-stamped IQ samples from four KiwiSDRs: F1JEK (JN05hs, southwestern France), SV3EXP (KM07qx, west Greece), UR5VIB (KN68DL, central Ukriane) and KHIMKI (KO85qw, near Moscow city Russia). 
Cross correlations suggest the Crimean peninsula as the area of Tx antenna. Since CIS-12 is widely used by Rus-Ny, it's quite reasonable to assume that the Tx be in Sevastopol, Black Sea fleet HQ. Note the scattering in the correlations involving the French SDR (F1JEK) which are due to multipath propagation.

 


Plots are obtained using my (old) Ubuntu 12.06 LTS updated to gcc 6.6 and gnuplot 4.4; TDoA algorithms implemented by Christoph mayer:
and GNU Octave, scientific programming language, version 4.4:



5 June 2018

Nokia msg terminal + Tadiran HF equipment

Transmission picked up some days ago by my friend AngazU using the SM2BYC Kiwi sdr. The signal is composed of an initial tone followed by a preamble consisting of F7B modulation (apparently MFSK-4) and two simultaneous FSK modulations (Fig. 1). As suggest by cryptomaster and KarapuZ, this is an interesting example of a Nokia Adaptive MSG Terminal which is used along with a Tadiran HF equipment that presumably provides an active noise cancellation feature.

Fig. 1 - waveforms
The upper FSK 125Bd/290 delivers the same 84-bit pattern and it's interesting to note that the last 84-bit sequence is sent in opposite polarity:  perhaps signalling the last group/block of data (sent in the lower FSK).  The same parameters (FSK and 84-bit pattern length) has been discussed here in radioscanner:
Although, of course, we can be wrong because a specific description of this function was not found TADIRAN HF modems.

The lower FSK 300Bd/780, after the initial 1-0 sync sequence pattern, delivers data and seems to have a 16-bit period. After differential demodulation the stream exhibits 8 solid bits columns in a 16-bit period and once removed the stream does not have a clearly defined period (Fig. 2).

Fig. 2 - bitstreams
Cryptomaster is inclined to the Machester modulation but I get errors in both the phase conventions (G.E.Thomas and IEEE 802), and he pointed me that the signal has a constant preamble whicH is not coded using Manchester (Fig. 3) and causes mistakes in decoding.

Fig. 3

As for as I can see, the same F7B + FSK125Bd structure is sent first but without the lower FSK300Bd (Fig. 4). The patterns are the same in the two FSK125Bd streams, perhaps it is used to initialize the (supposed) Tadiran noise blanker function?

Fig.4

3 June 2018

MIL 188-110C App.D: 9KHz/7200Bd & 12KHz/9600Bd

9KHz/7200Bd & 12KHz/9600Bd WBHF waveforms spotted on 9 MHz band. Both the ACFs show a value of 120ms that corresponds to 864 symbols for the 7200 Bd waveform (768 uk + 96k) and 1152 symbols for the 9600 waveform (1024 uk + 128 k).



The extra spikes in ACF diagrams, more evident in CCF, in my guess are due to the cyclically rotated version of the mini-probe which is utilized to identify the long interleaver block boundary (MIL 188-110D #D.5.2.2). Note that 2 data block make 4608-bit blocks (768x2x3) and 21 data blocks make 64512-bit block (1024x21x3), therefore the CCF spikes are related since 64512/4608=14


 

30 May 2018

T207_test

Finally a useful and fast tool to check the presence of T207 encoding in FSK bitstreams. The tool T207_test runs on Octave, a programming language for scientific computing, and was originally - and roughly - coded by me and then optimized and speeded-up by Christoph:

 Below an example where T207_test is successfully used on a 6 x 100Bd/120 VFT:  

The script builds a n x 14 test matrix and for each row computes the number of "1" bits in the first 12 columns; then check if the 13-14 bits value is the one expected according to the table below. Since the 2-bit 'checksum' can occur everywhere within the 14-bit frame, the stream is shifted up to 14 times building a new test matrix at each shift. The script counts the success checks for each test matrix and display the results. The better test matrix is also plotted along the frame start offset (ie after how many shifts).



25 May 2018

NATO naval broadcast and KW-46 encryption

This post follows up and completes the one of Christoph where he noticed the presence of LFSR delimited 7-bit frames in STANAG-4285 payloads. 
Given that: 

1) the HF waveform STANAG-4285 is largely used for NATO naval broadcasts;

2) the markers consist of the bits of pseudo-random sequence generated by the polynomial x^31+x^3+1, as specified by STANAG-5630 and already seen in FSK 50Bd/850;

3) those bits (termed "Fibonacci bits") are used by KW-46 cryptographic equipment to provide  synchronization; 

we can assume that NATO naval broadcasts are secured with KW-46 encryption. 

We analyzed several STANAG-4285 transmissions in both 600L and 1200L sub-modes picked up in well-known frequencies (belonging to British, Danish, Dutch, French, German, Norwegian and Spanish Navy) as:
1200L_10186.2, 1200L_10264.1, 1200L_13410.1, 1200L_7554.6, 1200L_9095.0, 600L_10733.3, 600L_12958.3, 600L_13057.7, 600L_5361.8, 600L_8170.2, 600L_8408.2, 600L_8612.2, 660L_11538.3 (all USB)
and in all we verified the presence of the Fibonacci bits.

STANAG-4285 bitstreams after deinterleaving and convolutional decoding
Fibonacci bits (before descrambling) 


By the way, NATO naval broadcast consists of a continuous coded stream of data which is typically be transmitted over multiple HF frequencies at the same time, providing an uninterrupted data flow from shore to ships. In the absence of messages to be transmitted, "jam" messages (pseduo-random chars) is injected into the data stream.

28 May update
NATO RATT (4481-F) 75Bd/850, same story as above, ie:
"taps" 1000000000000000000000000000100 = polynomial x^31+x^3+1 = FW-46 encryption. 
This stream has been processed using Octave scripts and Christoph's C++ code.



 

23 May 2018

French Navy Broadcast, FSK 50Bd/850

Following the previous post, I decided to analyze the French FSK 50Bd/850 in order to replicate the results obtained by my friend Christoph Mayer in his blog: happy to say that the results coincide.


French-Ny FSK 50Bd/850 has a characteristic 21-bit period and, in a way similar to STANAG-5065, two/three sub-frames which are delimited by the bits of two LFSR markers M1 M2 and a logical "1" value bit (1-bit). The sequences for the two markers are generated by the polynomials x^6+x^5+1 and x^7+x^6+1.
Since the missing of an initial sync in the recording, the 1-bit can occur in any position within the 21-bit frame therefore markers' positions are reported as relative to the 1-bit. A possible more significative layout shows 2 possible sub-frames (5 and 13 bits length).



 
Obviously, the length of the markers' patterns match the length of the respective generator polynomials.

 

22 May 2018

Exploring FSK 50Bd/850 transmissions for STANAG-5065 and KW-46 encryption

Although STANAG-5065 indicates the standards required for naval LF shore-to-ship broadcast with KW-46 encryption devices [1], some implementations of this standards can also be found in HF waveforms such as the FSK 50Bd/850. I came up with the idea to depeen after reading an interesting Christoph Mayer' post (by the way, a next post will deal with French Navy 21-bit period FSK-50Bd/850).

Quoting STANAG-5065 Annex A, BASEBAND PROCESSING [2]: 
"Encryption and decryption sall be provided by KW-46 interoperable cryptographic equipment operating in the 6.0 Stepped Digital mode. Encryption by the KW-46 equipment sall be coded in the 7-0 unit SART-TOP ITA2 alphabet. Encryption by the KW-46 equipment will result in bits 1 through 6 being encrypted and bit 7 (STOP) being replaced with an unencrypted and deterministic Fibonacci bit", where "Fibonacci bits = Deterministic unencrypted bits used by the KW-46 interoperable cryptographic equipment to provide synchronization defined by the polynomial x^31+x^3+1."


7-bit frame delimited by KW-46 sync bit
x x x x x x KW-46
1 2 3 4 5 6 7

The goal was to arrange the demodulated bits (courtesy of Christoph) into a 7-bit format stream and then process each column of the stream in order to find a descrambler polynomial - if any - that was the same as the one indicated in STANAG-5065 standard. As expected, only the bit-7 column can be successfully descrambled using the polynomial x^31+x^3+1.


As seen,  STANAG-5065 and KW-46 can be meet also in HF secured naval broadcasts with the commonly used FSK waveform 50Bd/850Hz. For what concerns the users, such signals were recorded on 4905, 4985, 7455 and 16123 Khz (all CFs) using KiwiSDRs located at DF0KL and at Newport,OR: user is probably US Navy.



 [1] In the late 1980's, the KW-46 simplex cryptosystem was introduced in order to provide communications security (COMSEC) for naval broadcasts to naval fleets (Fleet Broadcast). Formally, this equipment is called "Fleet Broadcast Security Equipment, TSEC/KW-46". The  KW-46 consists of the KWT-46 transmitter and the KWR-46 receiver (code name Vallor).

[2] STANAG-5065 Annex A